CVE-2026-35408
Last modified
CVE-2026-35408 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header. Without this header, a malicious cross-origin window that opens the Directus login page retains the ability to access and manipulate the window object of that page. An attacker can exploit this to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, causing the victim to unknowingly grant access to their authentication provider account (e.g. Google, Discord). This vulnerability is fixed in 11.17.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Monospace | Directus | < 11.17.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-35408?
How severe is CVE-2026-35408?
How do I fix CVE-2026-35408?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-35402mcp-neo4j-cypher is an MCP server for executing Cypher queri…2.3
- CVE-2026-35403LORIS (Longitudinal Online Research and Imaging System) is a…5.4
- CVE-2026-35404Open edX Platform enables the authoring and delivery of onli…6.1
- CVE-2026-35405libp2p-rust is the official rust language Implementation of …7.5
- CVE-2026-35406Aardvark-dns is an authoritative dns server for A/AAAA conta…7.5
- CVE-2026-35407Saleor is an e-commerce platform. From 2.10.0 to before 3.23…6.5
- CVE-2026-35409Directus is a real-time API and App dashboard for managing S…7.7
- CVE-2026-3541Inappropriate implementation in CSS in Google Chrome prior t…8.8
- CVE-2026-35410Directus is a real-time API and App dashboard for managing S…6.1
- CVE-2026-35411Directus is a real-time API and App dashboard for managing S…4.3
- CVE-2026-35412Directus is a real-time API and App dashboard for managing S…8.1
- CVE-2026-35413Directus is a real-time API and App dashboard for managing S…5.3
Are you affected by CVE-2026-35408?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST